I wanted to point my root domain (hosted by Google) to the Heroku app DNS target. I was able to solve this by using Cloudflare instead, with flattening.

(Thanks got your reply!) Also other drawbacks: lack of http/2, couldn’t configure mtls from cloudflare to avoid someone going around the waf